Initial commit

apps/n8n/manifests/external-secret.yaml

@@ -0,0 +1,49 @@
+# kubernetes/apps/n8n/external-secret.yaml
+# ExternalSecrets for n8n - pulls credentials from Vault
+
+# Note: Database password is managed by CNPG cluster (pg-n8n-app secret)
+# We reference it directly in the n8n values.yaml extraEnv section
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: n8n-config
+  namespace: n8n
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: n8n-config-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: encryption-key
+      remoteRef:
+        key: n8n-config
+        property: encryption-key
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: n8n-oauth
+  namespace: n8n
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: n8n-oauth-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: client-id
+      remoteRef:
+        key: n8n-oauth
+        property: client-id
+    - secretKey: client-secret
+      remoteRef:
+        key: n8n-oauth
+        property: client-secret